I'm trying to read the FILETIME's from the System profile fields that tells you when your account was created, last login, and last logout, but I'm getting the wrong results. What's wrong here?[code]Private Declare Function FileTimeToSystemTime Lib "kernel32" _
(lpFileTime As Filetime, lpSystemTime As SystemTime) As Boolean

Private Type Filetime
dwLowDateTime As Long
dwHighDateTime As Long
End Type

Private Type SystemTime
wYear As Integer
wMonth As Integer
wDayOfWeek As Integer
wDay As Integer
wHour As Integer
wMinute As Integer
wSecond As Integer
wMilliseconds As Integer
End Type

<..snip..>

Private Function StringToFiletime(T As String) As Filetime
Dim Frag() As String, FT As Filetime
Frag = Split(T, " ")
'If value too big for VB's signed long, make it "unsigned"
If Val(Frag(0)) > 2147483647 Then
FT.dwHighDateTime = Val(Frag(0)) - 2147483648#
Else
FT.dwHighDateTime = Frag(0)
End If
If UBound(Frag) > 0 Then
If Val(Frag(0)) > 2147483647 Then
FT.dwLowDateTime = Val(Frag(0)) - 2147483648#
Else
FT.dwLowDateTime = Frag(0)
End If
End If
StringToFiletime = FT
End Function

Private Function ProcessSystemTime(T As SystemTime) As String
Select Case T.wDayOfWeek
Case 0: ProcessSystemTime = "Sunday, "
Case 1: ProcessSystemTime = "Monday, "
Case 2: ProcessSystemTime = "Tuesday, "
Case 3: ProcessSystemTime = "Wednesday, "
Case 4: ProcessSystemTime = "Thursday, "
Case 5: ProcessSystemTime = "Friday, "
Case 6: ProcessSystemTime = "Saturday, "
End Select
Select Case T.wMonth
Case 1: ProcessSystemTime = ProcessSystemTime & "January"
Case 2: ProcessSystemTime = ProcessSystemTime & "February"
Case 3: ProcessSystemTime = ProcessSystemTime & "March"
Case 4: ProcessSystemTime = ProcessSystemTime & "April"
Case 5: ProcessSystemTime = ProcessSystemTime & "May"
Case 6: ProcessSystemTime = ProcessSystemTime & "June"
Case 7: ProcessSystemTime = ProcessSystemTime & "July"
Case 8: ProcessSystemTime = ProcessSystemTime & "August"
Case 9: ProcessSystemTime = ProcessSystemTime & "September"
Case 10: ProcessSystemTime = ProcessSystemTime & "October"
Case 11: ProcessSystemTime = ProcessSystemTime & "November"
Case 12: ProcessSystemTime = ProcessSystemTime & "December"
End Select
ProcessSystemTime = ProcessSystemTime & " " & T.wDay & ", " & T.wYear & " "
Dim ap$
If T.wHour > 12 Then
T.wHour = T.wHour - 12
ap = "PM"
Else
ap = "AM"
End If
ProcessSystemTime = ProcessSystemTime & T.wHour & ":" & T.wMinute & ":" & T.wSecond & _
" " & ap
End Function[/code]

What kind of "wrong results" are you getting?

Do you have to perhaps specify that lpFileTime and lpSystemTime are ByRef?

(Again, not a VB programmer).

The conversions from an unsigned value in a string to a signed value in a long are wrong. They should be:

[code]
if val(string) < 2^31 then dword = val(string) else dword = val(string) - 2^32
[/code]

edit: did put it in code tags after all

Still not giving proper results. Here's what StealthBot says:[code] [6:48:44 PM] Account Created: 5/22/2001, 14:34:10 (Battle.net time)
[6:48:44 PM] Last Logon: 5/4/2004, 23:48:47 (Battle.net time)
[6:48:44 PM] Last Logoff: 5/4/2004, 23:46:40 (Battle.net time)[/code]
and my bot:[code][6:49:24 PM] Recieved account statistics.
[6:49:24 PM] Account Created Filetime: 29635122 1873721440
[6:49:24 PM] Account Created: Tuesday, May 4, 2004 11:49:27 PM
[6:49:24 PM] Last Logged In: Tuesday, May 4, 2004 11:49:22 PM
[6:49:24 PM] Last Logged Out: Tuesday, March 17, 1648 3:04:53 PM[/code]

Updated String -> Filetime Code:[code]Private Function StringToFiletime(T As String) As Filetime
Dim Frag() As String, FT As Filetime
Frag = Split(T, " ")
If Val(Frag(0)) < 2 ^ 31 Then
FT.dwHighDateTime = Val(Frag(0))
Else
FT.dwHighDateTime = Val(Frag(0)) - 2 ^ 32
End If
If UBound(Frag) > 0 Then
If Val(Frag(1)) < 2 ^ 31 Then
FT.dwLowDateTime = Val(Frag(1))
Else
FT.dwLowDateTime = Val(Frag(1)) - 2 ^ 32
End If
End If
StringToFiletime = FT
End Function[/code]

[quote author=shadypalm88 link=board=17;threadid=6645;start=0#msg58554 date=1083715226]
[code][6:49:24 PM] Recieved account statistics.
[6:49:24 PM] Account Created Filetime: 29635122 1873721440
[6:49:24 PM] Account Created: Tuesday, May 4, 2004 11:49:27 PM
[6:49:24 PM] Last Logged In: Tuesday, May 4, 2004 11:49:22 PM
[6:49:24 PM] Last Logged Out: Tuesday, March 17, 1648 3:04:53 PM[/code]
[/quote]

Looks like you're parsing the wrong data.

"29635122 1873721440" is probably created,
"Tuesday, May 4, 2004 11:49:27 PM" logged in and
"Tuesday, May 4, 2004 11:49:22 PM" logged out.

Your debug output "steals" one of the filetimes?

[quote author=shadypalm88 link=board=17;threadid=6645;start=0#msg58385 date=1083649052]
...
[code]
Private Function ProcessSystemTime(T As SystemTime) As String
Select Case T.wDayOfWeek
Case 0: ProcessSystemTime = "Sunday, "
Case 1: ProcessSystemTime = "Monday, "
Case 2: ProcessSystemTime = "Tuesday, "
Case 3: ProcessSystemTime = "Wednesday, "
Case 4: ProcessSystemTime = "Thursday, "
Case 5: ProcessSystemTime = "Friday, "
Case 6: ProcessSystemTime = "Saturday, "
End Select
Select Case T.wMonth
Case 1: ProcessSystemTime = ProcessSystemTime & "January"
Case 2: ProcessSystemTime = ProcessSystemTime & "February"
Case 3: ProcessSystemTime = ProcessSystemTime & "March"
Case 4: ProcessSystemTime = ProcessSystemTime & "April"
Case 5: ProcessSystemTime = ProcessSystemTime & "May"
Case 6: ProcessSystemTime = ProcessSystemTime & "June"
Case 7: ProcessSystemTime = ProcessSystemTime & "July"
Case 8: ProcessSystemTime = ProcessSystemTime & "August"
Case 9: ProcessSystemTime = ProcessSystemTime & "September"
Case 10: ProcessSystemTime = ProcessSystemTime & "October"
Case 11: ProcessSystemTime = ProcessSystemTime & "November"
Case 12: ProcessSystemTime = ProcessSystemTime & "December"
End Select
...
[/code]
[/quote]

There are functions such as MonthName(), WeekdayName(), ect, to return those values for you

Thanks. There was a problem with my packet parser that was causing the first filetime to start 2 bytes too late.

[quote author=shadypalm88 link=board=17;threadid=6645;start=0#msg58596 date=1083720358]
Thanks. There was a problem with my packet parser that was causing the first filetime to start 2 bytes too late.
[/quote]

That's pretty amazing, to get results so near to Stealth's and find out that there was a fundamental flaw in the beginning of your packet parsing.

Are you sure it wasn't offsetting something somewhere?